What this site collects, why, for how long and who else sees it. Written to be read, not to be accepted unread.
This site sets no tracking cookies, runs no analytics, carries no advertising pixels and loads nothing from Google. The typefaces are served from our own machines: opening a page on aqumo.net tells no third party that you were here.
The only personal data we receive because you chose to give it is what you type into the contact form. Everything else is the ordinary technical record any web server keeps in order to stay up and stay safe.
This notice covers the public site www.aqumo.net. The myAqumo client area and the services we deliver under contract are governed separately — see the section at the end.
The controller is:
aqumo technologies SA
Via Ceresio 12, 6963 Pregassona (Lugano), Switzerland
Business identification number: CHE-113.809.603
Telephone: see the contact page
E-mail: address on the contact page
We have not appointed a data protection officer: Swiss law does not require one for a company of our size doing the processing we do. For anything to do with your data, write to the address above — it is read by the management.
Worth stating before the list of what we do, because it is usually the part people care about:
Like any web server, ours records the requests it receives. That is how we tell whether the site is working, diagnose an error and recognise an attack. We do not use these logs to build profiles and we do not cross-reference them with anything else.
| Data | Why | Legal basis |
|---|---|---|
| IP address | Security, diagnostics, abuse defence | Legitimate interest |
| Date and time, page requested, response code | Operation and diagnostics | Legitimate interest |
| Browser and operating system | Compatibility and bot detection | Legitimate interest |
| Referring page | Understanding where visits come from | Legitimate interest |
If you write to us from the contact page, we receive what you wrote. Only name and e-mail address are required: company, telephone, subject and even the message itself may be left blank and the enquiry will still go through.
Along with the message we record your IP address, your browser and the referring page, plus an automatically calculated spam score. This is not profiling: it is how we tell a real enquiry from an automated submission, and how we can reconstruct what happened if something goes wrong. The score blocks nothing, and no automated decision is taken about you.
The enquiry is stored in our records and we are notified by e-mail. That notification contains what you wrote, so that we can reply.
Legal basis: steps taken at your request prior to entering into a contract — you wrote to us to discuss possible work — and our legitimate interest in replying and in protecting the form from abuse.
The form is protected by several checks, some of which touch personal data:
The site uses one cookie, on one page only.
| Name | When | What for | Lifetime |
|---|---|---|---|
aqmsess |
On opening the contact page | Ties the form to your session, so a form copied elsewhere cannot submit in our name | Until the browser closes, or one hour idle |
It is a technical cookie, marked HttpOnly (scripts
cannot read it), Secure (it travels only over an
encrypted connection) and SameSite=Lax. It holds no
personal data: only a random identifier. A cookie strictly necessary
for the service you asked for needs no consent, which is why you
will find no banner here — there is nothing to accept or refuse.
No cookie is set on any other page of the site.
If you pick a language from the selector at the top, your browser
remembers it in a local storage key called aqumo_lang.
It stays on your device and is never transmitted to us: it is not a
cookie and it does not leave your browser. Clearing the site's data
in your browser settings removes it.
The contact page loads Cloudflare Turnstile, a check that distinguishes a person from an automated program without asking anyone to identify traffic lights in photographs. It exists to stop the form being used to send spam.
To do that, your browser contacts servers operated by Cloudflare, Inc. (101 Townsend St, San Francisco, California, USA). Cloudflare receives your IP address, some browser characteristics and signals about behaviour on the page; on submission we ourselves send your IP to Cloudflare for the final verification. According to Cloudflare, Turnstile does not use cookies to track people across sites and the data is not used for advertising.
This means data leaves Switzerland for the United States. The transfer relies on the Swiss–U.S. Data Privacy Framework, which the Swiss Federal Council recognised as providing adequate protection with effect from 15 September 2024 and to which Cloudflare states it has certified. Cloudflare additionally applies the European Commission's standard contractual clauses.
Legal basis: our legitimate interest in defending the form from abuse. Turnstile is present on the contact page only: nothing from Cloudflare is loaded anywhere else on the site.
If you would rather not go through Turnstile, you can reach us by telephone or write directly to our e-mail address. There is no disadvantage in doing so, and no need to open the contact page at all.
The site and the mail run on our own infrastructure, in Switzerland, administered by our own staff. There is no third-party hosting provider processing the data on our behalf, and no external mail service through which your messages pass.
Beyond the above, the data does not leave Switzerland.
| What | How long | Why |
|---|---|---|
| Server logs | Technical rotation, on the order of weeks | Beyond that they diagnose nothing |
| Contact form enquiries | Up to 24 months from the last exchange | Picking up a conversation again, and documenting how a commercial relationship began |
| Submission attempt log | Up to 12 months | Recognising recurring spam sources |
Where an exchange turns into a contract, the data forming part of it follows the statutory retention periods for business records, which are longer.
You can ask us to delete sooner at any time — see the next section.
The Swiss Federal Act on Data Protection gives you the right to:
To exercise them, write to us: the address is in the first section. We answer within thirty days. We will not ask for identity documents if we can identify you another way — usually it is enough that the request comes from the same e-mail address you wrote from. Exercising these rights is free.
You may contact the Swiss supervisory authority:
Federal Data Protection and Information Commissioner
(FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
www.edoeb.admin.ch
We would rather hear it from you first, though: it is nearly always something we can put right in an afternoon.
We are a Swiss company and the primary reference is the Swiss Federal Act on Data Protection. If you write to us from the European Union the General Data Protection Regulation may also apply: in that case the legal bases given above correspond to Article 6(1)(b) (pre-contractual steps) and 6(1)(f) (legitimate interest), and to the rights listed above is added the right to lodge a complaint with the supervisory authority of your country of residence.
Some of the technical measures, for those who want to know:
No measure makes a system impregnable. Should a breach occur that poses a high risk to your rights, we are required to notify the authority and, where necessary, you directly.
myAqumo sits behind authentication and is not covered by this notice. Project data, uploaded documents and the processing that happens there are governed by the contract in place with each client and by the data processing terms that form part of it. If you are a client and want the detail, ask us and we will send it.
When something changes in how we handle data, we update this text and publish a new version. Each version carries a number and a date, shown at the top of the page. We keep the earlier versions: if you need to know what the notice said on a particular day, ask us and we will send it.
Should a change be substantial — a new recipient of data, a new purpose — we will not simply swap the file in silence: we will say so on the site.